PT-2002-1607 · Openbsd · Openbsd

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0557

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBSD version 3.0

Description The issue causes problems when using YP with netgroups in the password database. This can lead to unauthorized access, where (1) rexec or (2) rsh can run another user's shell, or (3) atrun can change to a different user's directory. The cause might be related to memory allocation failures or an incorrect call to auth approval().

Recommendations For OpenBSD version 3.0, consider restricting the use of YP with netgroups in the password database until a fix is available. As a temporary workaround, limit the use of rexec, rsh, and atrun to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0557

Affected Products

Openbsd

References · 4

• http://openbsd.org/errata30.html#approval · Vendor Advisory
• http://securityfocus.com/bid/4338 · Vendor Advisory
• http://iss.net/security_center/static/8625.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0557 · Security Note